Cybersecurity for industrial automation and OT
PLCs, drives, robots, industrial PCs, gateways and engineering software, linked to IT networks, clouds and remote maintenance.
Production that must run, built from components that must be trusted.
Industrial automation connects PLCs, drives, robots, HMIs and engineering stations with IT networks, cloud services and remote maintenance. Plants run for decades, and many devices were designed for isolated networks.
Two groups carry the risk. Manufacturers of automation components now have to prove product security under the CRA and IEC 62443. Operators see production stop when ransomware spreads from the office into the plant.
Who it is for
- Manufacturers of PLCs, drives, sensors, HMIs and industrial PCs
- Machine builders and system integrators
- Operators of production plants and process facilities
- Providers of remote maintenance and industrial software
Where plants and components are exposed today
The attack paths we see most often in industrial automation and operational technology.
Remote access
Remote maintenance
VPNs and remote tools of integrators and vendors are often always on, with shared accounts. They are the most common way into plant networks.
Network
Flat plant networks
Office and production share one network. Ransomware that starts with an email reaches PLCs and HMIs.
Engineering
Engineering workstations
Whoever controls the engineering station can change PLC programs. These PCs are rarely patched and seldom monitored.
Protocols
Unauthenticated protocols
Many industrial protocols accept commands from anyone on the network. One compromised host can stop or change the process.
Legacy
Systems that cannot be patched
Controllers and operating systems stay in service for decades. Where patches are impossible, compensating measures are needed.
Safety
Safety systems
Safety controllers are the last line of defence. When they share the network with everything else, attackers can reach them too.
Supply chain
Firmware and third-party libraries
Devices ship with software from many vendors. One vulnerability in a common library affects many products and plants at once.
Cloud
IIoT and cloud connections
Gateways send machine data to clouds and dashboards. Poorly secured connections open a path back into the plant.
When it went wrong
Three documented cases from industry. They show how an attack moves from IT into production, and why component makers are targets as well.
March 2019, ransomware
Norsk Hydro: aluminium production switches to manual
LockerGoga ransomware hit the Norwegian aluminium producer on 19 March 2019 and spread across its global network. Many plants switched to manual operations to keep running.
Impact
The company estimated the financial impact of the first week alone at NOK 300 to 350 million. Some business units were close to a standstill for days.
Sources: Norsk Hydro updates, March 2019; Al Circle
2017, safety system attack
Triton: malware aimed at the last line of defence
At a petrochemical plant in Saudi Arabia, attackers deployed malware designed to manipulate Triconex safety instrumented systems, the controllers that bring a process to a safe stop.
Impact
A flaw in the attack tripped the safety system and shut the plant down, which led to its discovery. It was the first known malware built to target safety systems that protect human life.
Sources: Mandiant (FireEye), December 2017; CISA
October 2019, ransomware
Pilz: an automation maker goes offline worldwide
The German automation company was hit by ransomware on 13 October 2019. All servers and PC workstations worldwide were affected, including communication systems, and the company took its systems off the network.
Impact
A week later, delivery capability was back only for some areas. Component makers are targets too, and their outage reaches every customer waiting for parts.
Sources: Pilz statement, October 2019; ZDNet; Bitdefender
What a working OT security approach looks like
Six building blocks from IEC 62443 that work for component makers and plant operators alike.
1
Asset inventory
Every device, its firmware and its connections are known. You cannot protect what you cannot see.
2
Zones and conduits
The plant is split into zones and every connection between them is controlled, as IEC 62443-3-2 describes.
3
Secure remote access
Individual, time-limited access for vendors and integrators, with approval and logging.
4
Secure development
A product security process for component makers, aligned with IEC 62443-4-1 and the CRA.
5
Vulnerability and patch management
Advisories are assessed, patches applied where possible, and systems that cannot be patched are protected.
6
Detection and recovery
OT network monitoring, tested backups and a plan to restart production after an attack.
How we help
For component makers and plant operators, from the first assessment to tested protection.
OT and plant security
A plant that keeps running when IT is attacked.
What we do
- Assessment against IEC 62443-2-1 and 62443-3-3
- Zone and conduit model with risk assessment
- Remote access, backup and recovery concept
You receive
Zone model, risk assessment, measure plan
Product security engineering
IEC 62443 and CRA conformity for your automation components.
What we do
- Threat analysis per product line
- Security requirements based on IEC 62443-4-2
- Secure development process to IEC 62443-4-1
You receive
Threat analysis, requirement set, process documentation
Regulatory readiness
Clarity on the CRA, NIS2 and the Machinery Regulation for your products and sites.
What we do
- Applicability check and product classification under the CRA
- Gap analysis against the essential requirements
- Roadmap with priorities and effort
You receive
Classification, gap list, roadmap
Testing and vulnerability handling
Evidence that your products and plants withstand real attacks.
What we do
- Penetration tests of components and plant networks
- Product security incident response and coordinated disclosure
- Preparation for the CRA reporting obligations
You receive
Test report, response process, reporting playbook
How we work
Step 1
Scope
We agree on the products, plants and standards in scope.
Step 2
Assess
Site visits, workshops and a document review show where you stand today.
Step 3
Build
We create the work products with your engineers, or generate them with AITIGRITY.
Step 4
Prove
Tests, reviews and audit preparation close the gaps that matter.
Standards and regulations
IEC 62443
The international series for industrial automation and control systems: security programme (2-1), risk assessment with zones and conduits (3-2), system requirements (3-3), secure development (4-1) and component requirements (4-2).
Cyber Resilience Act (EU) 2024/2847
Applies to automation components with digital elements. Reporting obligations apply since 11 September 2026, the full requirements from 11 December 2027.
NIS2
Many manufacturing companies are now essential or important entities with duties for risk management and incident reporting. In Germany, the NIS2 implementation act has been in force since December 2025.
Machinery Regulation (EU) 2023/1230
From 20 January 2027, machines must be protected against corruption, including through connected devices and remote access.
IEC 61508 and IEC 61511
Functional safety for electrical systems and the process industry. IEC 61511 asks for a security risk assessment of safety instrumented systems.
Related services and modules
The consulting services and AITIGRITY modules used most often in industrial automation.
Not sure where to start?
A short scoping call shows which requirements apply to your products or plants and what comes first.
Talk to an expertFrequently asked questions
We make automation components. Which parts of IEC 62443 matter for us?
Mainly 62443-4-1 for the development process and 62443-4-2 for the technical requirements of your components. Together with the CRA, they define what customers and authorities will ask for.
Our plant runs on systems that cannot be patched. What can we do?
Separate them into zones, control the connections, restrict remote access and monitor the network. IEC 62443 calls these compensating measures.
Does NIS2 apply to our company?
Many manufacturing sectors are covered above a certain company size. We check whether you are an essential or important entity and what follows from it.
Can you work with our integrators and suppliers?
Yes. We define requirements for integrators and suppliers and review their work, so the plant reaches the target security level.
Where does your product stand?
Tell us about your product and the rule you are facing. You talk to an engineer from the first call.
Cybersecurity consulting and the AITIGRITY platform for connected products and industrial systems.